> Source: [sk111599](https://support.checkpoint.com/results/sk/sk111599)

# sk111599 - Client side authentication error: "Certificate contains an unknown critical extension - 2.5.29.54...."

| Property | Value |
|----------|-------|
| Solution ID | sk111599 |
| Date Created | 2016-05-20 |
| Last Modified | 2025-10-02 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | Gaia |

## Symptoms

- * Error seen on the Client side:  

  ` Certificate contains an unknown critical extension - 2.5.29.54. OU=Entrust Managed Services Root CA,OU=Certification Authorities,O=Entrust,C=US`  

* Gateway side VPN debug (*vpnd.elg* ) shows:  

  ` [ 4770][9 May 17:26:20][VALIDATE] fwValidateCert: serial number: 11814`  
  ` [ 4770][9 May 17:26:20][] fwValidateCert:certificate - OU=Entrust Managed Services Root CA,OU=Certification Authorities,O=Entrust,C=US`  
  ` [ 4770][9 May 17:26:20][] notBefore: Thu Jul 30 13:18:52 2015 Local Time`  
  ` [ 4770][9 May 17:26:20][] notAfter: Wed Jul 30 13:12:42 2025 Local Time`  
  ` [ 4770][9 May 17:26:20][] now: Mon May 9 17:26:20 2016 Local Time`  
  ` [ 4770][9 May 17:26:20][] cert start grace period=7200 cert end grace period=0`  
  ` [ 4770][9 May 17:26:20][] fwValidateCert: there are unhandled critical extension`  
  ` [ 4770][9 May 17:26:20][VALIDATE] fwValidatePath: failed in level: 2`  
  ` [ 4770][9 May 17:26:20][cpcrypto_init] CPCRYPTO_LOCK:DEBUG :-175659328:AsnOid2fwString`  
  ` [ 4770][9 May 17:26:20][cpcrypto_init] CPCRYPTO_UNLOCK:DEBUG :-175659328:AsnOid2fwString`  
  ` [ 4770][9 May 17:26:20][] fwCert_ValCerts: Certificate contains an unkown critical extension - 2.5.29.54. OU=Entrust Managed Services Root CA,OU=Certification Authorities,O=Entrust,C=US`  
  ` [ 4770][9 May 17:26:20][cpcrypto_init] CPCRYPTO_LOCK:DEBUG :-175659328:AsnOid2fwString`  
  ` [ 4770][9 May 17:26:20][cpcrypto_init] CPCRYPTO_UNLOCK:DEBUG :-175659328:AsnOid2fwString`  
  ` [ 4770][9 May 17:26:20][] fwCert_ValPeerCertAndFindKey: Certificate contains an unkown critical extension - 2.5.29.54. OU=Entrust Managed Services Root CA,OU=Certification Authorities,O=Entrust,C=US`

## Cause

The certificate contains an unfamiliar/custom critical extension.  
The certificate verification fails due to a missing handler for this extension.

## Solution

[Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.   
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.  

Hotfix installation instructions for Gaia OS:

1. Hotfix has to be installed on ***Security Gateway / each cluster member***.

**Note**: In cluster environment, this procedure must be performed on all members of the cluster.

2. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*).

3. Unpack the hotfix package:

***\[Expert@HostName\]# cd /some_path_to_fix/***   
***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\<HOTFIX_NAME\>.tgz***

4. Install the hotfix:

***\[Expert@HostName\]# ./fw1_wrapper_\<HOTFIX_NAME\>***

**Note**: The script will stop all of Check Point services (cpstop) - read the output on the screen.

5. Reboot the machine.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content